import{a as c,b as h,c as f,d as y,f as n,g as i}from"./chunk-QSLKOXQ6.js";import{a as r}from"./chunk-76FD5Z7D.js";import{randomUUID as E}from"crypto";var k=32,v=class{name="local";masterKey;salt;keyVersion;constructor(e){let t=e.masterKey??g();if(!t)throw new Error("Master key required. Set VAULT_LOCAL_MASTER_KEY or VAULT_MASTER_KEY env var, or pass masterKey in config.");if(this.masterKey=Buffer.from(t,"utf-8"),this.masterKey.length<k)throw new Error(`Vault master key too short: ${this.masterKey.length} bytes, need at least ${k}. Set VAULT_LOCAL_MASTER_KEY / VAULT_MASTER_KEY to a value with at least 32 bytes of entropy.`);this.salt=e.salt??Buffer.from("nebutra-vault","utf-8"),this.keyVersion=e.keyVersion??1,r.debug("[vault:local] Initialized",{keyVersion:this.keyVersion})}buildAad(e,t){return Buffer.from(`v2|tenant=${e??""}|kek=${t}`,"utf-8")}async deriveKek(){let e=Buffer.from(`nebutra-vault-kek-v${this.keyVersion}`,"utf-8");return f(this.masterKey,this.salt,e)}async encrypt(e,t){try{let a=await this.deriveKek(),u=y(32),o=this.buildAad(t?.tenantId,this.keyVersion),s=c(u,a,o),l=c(e,u,o),m={id:t?.id??E(),ciphertext:n(l.ciphertext),encryptedDek:n(s.ciphertext),iv:n(l.iv),authTag:n(l.authTag),dekIv:n(s.iv),dekAuthTag:n(s.authTag),keyVersion:this.keyVersion,envelopeVersion:2,algorithm:"aes-256-gcm",...t?.tenantId!==void 0?{tenantId:t.tenantId}:{},...t?.metadata!==void 0?{metadata:t.metadata}:{},createdAt:new Date().toISOString()};return r.debug("[vault:local] Secret encrypted",{id:m.id,tenantId:t?.tenantId}),m}catch(a){throw r.error("[vault:local] Encryption failed",{error:a}),new Error(`Local vault encryption failed: ${a instanceof Error?a.message:String(a)}`)}}async decrypt(e,t){try{if(t?.tenantId&&e.tenantId&&e.tenantId!==t.tenantId)throw new Error("Tenant ID mismatch");e.keyVersion!==this.keyVersion&&r.warn("[vault:local] Key version mismatch",{secretVersion:e.keyVersion,currentVersion:this.keyVersion});let a=Buffer.from(`nebutra-vault-kek-v${e.keyVersion}`,"utf-8"),u=await f(this.masterKey,this.salt,a),o=e.envelopeVersion===2?this.buildAad(e.tenantId,e.keyVersion):void 0,s;if(e.dekIv&&e.dekAuthTag)s=h(i(e.encryptedDek),u,{iv:i(e.dekIv),authTag:i(e.dekAuthTag)},o);else throw new Error("Encrypted DEK missing IV/authTag \u2014 cannot decrypt. Re-encrypt with current version.");let l=h(i(e.ciphertext),s,{iv:i(e.iv),authTag:i(e.authTag)},o);return r.debug("[vault:local] Secret decrypted",{id:e.id,tenantId:t?.tenantId}),l.toString("utf-8")}catch(a){throw r.error("[vault:local] Decryption failed",{error:a}),new Error(`Local vault decryption failed: ${a instanceof Error?a.message:String(a)}`)}}async rotateKey(e){try{let t=await this.decrypt(e),a=await this.encrypt(t,{id:e.id,...e.tenantId!==void 0?{tenantId:e.tenantId}:{},...e.metadata!==void 0?{metadata:{name:e.metadata.name,type:e.metadata.type,...e.metadata.expiresAt!==void 0?{expiresAt:e.metadata.expiresAt}:{}}}:{}});return a.rotatedAt=new Date().toISOString(),r.debug("[vault:local] Key rotated",{id:e.id}),a}catch(t){throw r.error("[vault:local] Key rotation failed",{error:t}),new Error(`Key rotation failed: ${t instanceof Error?t.message:String(t)}`)}}async rotateKek(){this.keyVersion+=1,r.info("[vault:local] KEK rotated",{newVersion:this.keyVersion})}async generateDek(){return y(32)}async close(){r.debug("[vault:local] Closed")}};function g(){let d=process.env.VAULT_MASTER_KEY,e=process.env.VAULT_LOCAL_MASTER_KEY;if(d&&e&&d!==e)throw new Error("Vault local key mismatch: VAULT_MASTER_KEY and VAULT_LOCAL_MASTER_KEY are both set but differ.");return e??d}export{v as a};
